Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in how Skipper's OpenPolicyAgent (OPA) integration handles HTTP requests with chunked transfer encoding. When a client sends a request with Transfer-Encoding: chunked, Go's HTTP server sets the ContentLength of the request to -1. The ExtractHttpBodyOptionally function in filters/openpolicyagent/openpolicyagent.go did not properly handle this negative ContentLength. It passed this -1 value to the fillBuffer function. The fillBuffer function has a loop that reads the request body, but the loop's condition int64(m.bodyBuffer.Len()) < expectedSize fails immediately when expectedSize is -1 (since 0 < -1 is false). Consequently, the request body is never read, and an empty body is passed to the OPA engine for authorization. This allows a malicious actor to bypass any OPA policies that inspect the request body, as the policy will be evaluated against an empty input. The fix ensures that when ContentLength is negative, a configured maximum body size is used instead, forcing fillBuffer to read the body of chunked requests.
OpenPolicyAgentInstance.ExtractHttpBodyOptionallyfilters/openpolicyagent/openpolicyagent.go
bufferedBodyReader.fillBufferfilters/openpolicyagent/openpolicyagent.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/zalando/skipper | go | < 0.26.10 | 0.26.10 |